Firestore: Missing or insufficient permissions

What it means in plain English

The client error is Missing or insufficient permissions, with code permission-denied. Firebase's AI Studio guide says this happens when the app reads or writes Cloud Firestore and Security Rules reject the operation. The rules are not allowing it for the current authentication state or the data path. Being signed in is not enough if the rule does not allow that path.

The App Check web codelab shows the same string, FirebaseError: [code=permission-denied]: Missing or insufficient permissions., when App Check enforcement blocks a request that did not pass attestation. Rules and App Check can both produce it. The rules walkthrough is Firestore request failed because security rules denied it.

Likely causes

• The deployed rules still have allow read, write: if false, so every read fails, including after login.
• The rule requires request.auth != null, and the read runs before the auth state is ready, so request.auth is still null.
• The rule allows only the signed-in user's own documents, and the query asks for a wider set. Firestore fails the whole query.
• App Check is enforced and this client is not sending a valid attestation.

How to fix it, step by step

1. Read the code. permission-denied plus "Missing or insufficient permissions" is the rules or App Check rejection, not a missing API key.
2. Open the deployed Firestore rules and match them to the path the screen reads. Publish the rules, then wait. The step-by-step for the console, the playground, and firebase deploy --only firestore is the rules page linked above.
3. Start the read only after you have a signed-in user. A rule of request.auth != null denies the request while auth is still loading.
4. If the rules already allow that signed-in read in the Rules Playground, check App Check. The codelab says enforcement blocks unverified clients with this same error. Either initialize App Check in the app or turn enforcement off until the client sends a token.
5. Do not switch the rules to allow read, write: if true to clear the message.

How to check it worked

• The same screen, with the same signed-in user, returns the documents.
• A signed-out session still fails, if that is what the rule says.
• The console no longer shows Missing or insufficient permissions for that read.

How this differs from a Supabase query that comes back empty is in Supabase vs Firebase.

Sources

• https://firebase.google.com/docs/ai-assistance/ai-studio-integration (opens in a new tab)
• https://firebase.google.com/codelabs/appcheck-web (opens in a new tab)
• https://firebase.google.com/docs/firestore/security/get-started (opens in a new tab)